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The BpnoTable George J. . Opfer 
Irtspector General, 
Page 2 



Your report has provided us with a template for the changes and initiatives needed 
to make our transformation. Some of these clianges are currently underway in the 
Department and some will begin soon. I realize, however, that tlie recommendations 
contained in this report are just a start. Achieving our goal of leadership in the federal 
government in protecting personal information will require much more. I intend to enlist 
the assistance of leading experts in the field of data security to assist us in identifying our 
path to reach the "Gold Standard." By "'Gold Standard" 1 mean that VA must be the best 
in the federal government in protecting personal and health information, Gaining and 
educating our employees in best practices, and cstabiishing a culture that always puts the 
custody of veterans' personal information first, over and above employee convenience or 
expediency'. It is rai.sing our scores in the annual FISMA audit to an "A" and becoming the 
system to emulate for all other agencies. Our Nation's heroes deserve only the best we can 
provide in data protection. 

Training in information and cyber security will be a vital component of our 
transfoimatjon. To ensure qualit)' and consistency m tfaining, I have directed 
establistttnent of a new Offiee of Cyber k Mormation Security Training (COST) in the 
Office of Information Technology. Thai office will be responsible for a training program 
that begins with new employee orientation and continues through senior leadership, 
including such programs as Leadership VA, the BBS Candidate Development Program 
and the Senior Leadership Academy, i envision a continual emphasis on Infonnarion 
sKuritj' thmughoutan employee's career. 

Excellence in information security will take the full commitment of VA's senior 
leadership, botii politicai appointees and career senior executives. It will also take money, 
and we will seek the budgetary resources tliat we need for success from the 
Administration and the Congress, It will also take lime, but my sense of urgency is clear. 
My focus is the Gold Standard for information security and I will require steady progress 
toward that goal. Industry' experts will help us develop the program changes and validate 
our timelines, AH employees will be held accountable for safeguarding the private 
information entrusted to us by veterans and beneficiaries. I v.'ill not be satisfied until VA 
is recognized as the leader in the federal government in information security. 
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The Hottorable George- J, Opler 

InspectorQeiiieral 

Page 3, 



Enclosed, fouwil foda detailed response to each ol the recommendations 
contained in the repcart to aildjsss eatii recommendation, I have included actions taken 
to date and numeroifsi otet planned aclions, VA will continue to work with you as we 
implement ftese changes. 



directly. 



U you have questions related to our responses, please feel tree to contact me 



Sincerely yours, ^ 




R. Jame^ Nicholson 



Enclosures 
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ISSUES 1-4: Issues Related to the Departmental Response to the Data Breach. 

Recommendation 1: Take whatever administrative actions deemed appropriate 
concerning the individuals involved in the inappropriate and untimely handling of 
the notification of stolen VA data involving the personal identifiers of millions of 
veterans. 



Concur 



Target Completion: August 4, 2006 



I have directed four separate Administrative Investigations (AI). The AIs are detailed 
below. 

I have directed an Administrative Investigation to review the actions of the employees 
in the Office of Policy and Planning following the data breach. I anticipate the results of 
the Investigation by August 4, 2006. I note that Mr. McLendon resigned on June 2, 2006 
and that Mr. Duffy retired on June 30, 2006. Charge letter is attached. (TAB 1) 

I have directed an Administrative Investigation to review the actions of the employees 
in the Office of General Counsel following the data breach. I anticipate the results of the 
Investigation by August 4, 2006. Charge letter is attached. (TAB 1) 

I have directed an Administrative Investigation to review actions of the employees in 
the Office of Security and Law Enforcement following the data breach. I anticipate the 
results of the Investigation by August 4, 2006. Charge letter is attached. (TAB 1) 

I have directed an Administrative Investigation to review the actions of the employees 
in the Office of Cyber and Information Security and Security Operations Center as they 
relate to this incident. I anticipate the results of the Investigation by August 4, 2006. 
We note that Mr. Johnny Davis, Jr., Acting Assistant Deputy Assistant Secretary for 
Cyber Security Operations, transferred to another Federal Agency effective July 9, 2006, 
and Mr. Pedro Cadenas, Director of the Office of Cyber and Information Security, has 
resigned with an effective date of July 13, 2006. Charge letter is attached. (TAB 1) 

With respect to the political appointees who serve on my immediate staff, I will 
carefully review the materials concerning their actions and make decisions accordingly. 
Central to all of the decisions that I will make regarding personnel cited in your report 
will be what is best for VA and the veterans we serve. 
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1. Implementation of a Centralized Agency-wide IT Security Program 

As part of the actions taken to centralize the operations and maintenance function 
within the Office of the CIO, the responsibiHty for IT security has, in fact, been 
centralized. This will greatly enhance VA's ability to provide clear direction and 
enforce compliance in a wide variety of security and privacy-related areas. 
Additionally, the June 28, 2006, Delegation of Authority memorandum (TAB 6) will 
greatly enhance the ability of the CIO to enforce compliance. An organizational chart 
is attached. (TAB 7). 

In October 2005, 1 signed a memorandum directing the reorganization of IT within 
VA. Pursuant to that reorganization, more than 4,610 IT professionals engaged in 
operations and maintenance of the Department's IT infrastructure, plus 560 
unencumbered positions, have been detailed to the Office of Information and 
Technology, under the direction of the Chief Information Officer. As of the 
beginning of the new Fiscal Year on October 1, 2006, those IT professionals will 
become permanently assigned to OIT, and concurrently a new career field within 
OIT will be established. 

In this IT reorganization, all IT professionals, except for certain software developers, 
are being consolidated into the Office of Information and Technology. The CIO will 
be responsible for enterprise architecture, project planniag approval through the 
OMB 300 process, funding and cyber and information security for all IT 
professionals including software developers. 

Other functions are being centralized within VA IT as well. I established the new 
position of Chief Financial Officer (CFO) for OIT with budget authority over all 
funds in the Office of Information and Technology, including the new IT Fund 
established by Congress. Recruiting for this position is well underway. 

In the past, there have been questions regarding the authority to the CIO under the 
Federal Information Security Management Act (FISMA). On June 28, 2006, 1 signed 
a Memorandum explicitly delegating all information security authority and 
responsibilities granted to me under FISMA, including enforcement, to the CIO. 

I announced at a Congressional oversight hearing of the House Committee on 
Veterans' Affairs on June 29, 2006, that I plan to further centralize all IT 
development in the future. 
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2. Implementation of a Patch Management Program 

As stated in the VA response in the last FISMA report, OIT established a patch 
management program that will be further enhanced as a result of the reorganization 
mentioned above. This will include the implementation of an Enterprise Security 
Framework, which is being piloted at several sites in FY 06 in anticipation of 
deployment beginning in FY 07. 

3. Electronic Security 

As a result of our IT Reorganization, improvements have already begun to remedy 
these issues. The Assistant Secretary for Information & Technology has been 
delegated full authority and responsibility for policy, training, inspection, 
enforcement and incident response. 

The CIO has established a "Transmission of Privacy Information in Clear Text 
(TOPIC)" work group to determine classes of data within the VA environment. This 
effort will be intensified and will focus on developing strategies for implementing 
controls to protect classes of sensitive information. In the interim, OCIS is working 
with the Administrations to increase the application of "Public Key Infrastructure 
(PKI)" certificates to protect sensitive email transmissions. These will include 
correcting deficiencies regarding password controls, remote access, and security of 
critical files. These efforts are expected to complete by February 2007. 

4. Personnel Security 

As stated in the response to Issue 5, 1 fully concur with this recommendation. An 
extensive effort is under way to improve the Department's performance in the areas 
of sensitivity risk identification and the corresponding background investigations. 

To summarize our efforts: 

VA Administrations and Staff Offices, in consultation with the CIO and HR, are 
undertaking a complete review of position sensitivity/risk level designations and 
existing background investigation levels for all employees, volunteers, interns, 
students, residents, contractors and sub-contractors. By October 31, 2006, all 
Administrations and Staff Offices will complete the review of position 
sensitivity/risk level designations and establish commensurate background 
investigation requirements. Senior executives will ensure the update of official 
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personnel folders and the amendment and revision of contracts, as necessary, to 
document the revised sensitivity level designations and commensurate background 
investigation requirements. 

New background investigations, where needed, will be initiated as soon as possible. 

VA Directive/Handbook 0710, Personnel Suitability and Security Program, will be 
revised by December 31, 2006 to reflect the expanded requirements. 

Additionally, the performance plans for all supervisors, managers and senior executives 
will include a specific requirement for the protection of sensitive information and 
responsibilities. 

Training courses in Suitability Adjudication and Position Sensitivity /Risk Designation 
have been conducted for human resources persormel. VA will seek a digital position 
management system that will automate classification and position sensitivity /risk 
designation. 

5. Background Investigations 

As stated in our response to Issue 5, an extensive effort is under way to improve the 
VA's performance regarding background investigations - with special emphasis on 
those positions requiring extensive access to sensitive information and computer 
systems/networks. VA is working aggressively to resolve problems that have 
existed for some time with background investigations. As a result, a number of 
activities have occurred or have been planned. Specifics are provided in item 4 
above. 

One of the improvements is the use of the Electronics Questionnaires for 
Investigations Processing (e-QIP), an OPM sponsored system designed to allow 
electronic completion and submission of all personnel investigation forms to OPM 
for completion of the investigations. VA is actively involved in the implementation 
of e-QIP. The current schedule will result in over 70% of VA facilities utilizing e-QIP 
by December 31, 2006, and 100% usage by March 2007. 

6. Deployment and Installation of Intrusion Detection Systems 

Although action is already underway to remedy this condition and improvements 
have taken place, additional review is needed. As part of the reorganization of 
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the Office of Information and Technology, including the Office of Cyber and 
Information Security, the CIO will establish a robust audit and inspection capability. 
This, along with the Delegation of Authority Memorandum mentioned earlier, will 
further enhance the ability of the CIO to ensure intrusion detection devices, to warn 
of unauthorized entry, are in place, and that they remain in place and in use. 

7. Infrastructure Protection Actions 

Work continues on the VA's critical infrastructure protection plan, but what is 
needed is more rigorous audit and inspection of existing conditions regarding the 
inappropriate destruction, manipulation or disclosure of sensitive information. A 
VA "Critical Infrastructure Protection Plan" is in development. Progress has been 
made at the Department level on completion of a Continuity of Operations Plan 
(COOP) and completion of an Emergency Preparedness Directive/Handbook 0320. 
VA is currently developing a Master COOP plan which will include the VA Central 
Office (VACO) and individual COOPs. 

8. Information Technology Centers' Continuity of Operations Plans 

VA continues to make progress in this area. The Austin Automation Center 
continues to conduct COOP tests annually and has worked to integrate its COOP 
with the resident organizations at its facility and the Hines and Philadelphia IT 
Centers. More extensive testing needs to be accomplished and as part of the action 
plan noted earlier; such testing will take place during FY 07 and be complete by 
August 2007. 

9. Certification and Accreditation Process 

Although the IG found that extensive C&A's were accomplished by the end of 2005, 
VA has recently discovered, as a result of a comprehensive data call, that additional 
systems exist which may require certification and accreditation. This additional 
C&A work will be accomplished by the end of FY 06. 

10. Terminate/Upgrade External Connections 

VA has done detailed work in this area and has reduced the known gateways to the 
Internet from over 200 to four. As we move to centralize the operations and 
maintenance domain, we will be better able to identify unauthorized connections 
and eliminate them and take vigorous corrective measures when violations of VA's 
policies are discovered. 
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11. Configuration Management 

VA continues to operate a small number of Windows 95/98 systems for applications 
that are not compatible with Windows 2000 at the Veterans Benefits Administration 
(for The Imaging Management System - TIMS). These are expected to be retired or 
replaced by the end of FY 06. However, more intensive efforts need to take place to 
upgrade all VA computers to the XP Operating System and to upgrade peripheral 
devices as necessary. This effort is included in VA's FY 07 budget and completion is 
targeted for the end of FY 07. 

With the Delegation of Authority Memorandum of June 28, 2006, the CIO has the 
authority to establish and implement policies and procedures to ensure compliance 
with National Institute of Standards and Technology (NIST) Special Publications 
800-53, Recommended Security Controls for Federal Information Systems and 800- 
64, Security Considerations in the Information System Development Life Cycle 
which relate to configuration management and change control. This Delegation of 
Authority, together with full implementation of the IT organization realignment, 
will allow the CIO to direct remediation of these deficiencies. The VHA Office of 
Information has developed a detailed Configuration Management Plan, Change 
Control Process, and Maintenance Procedures to support the system development 
life cycle for VistA and local area networks. The CIO is tracking deficiencies for 
those systems not in compliance with these requirements. 

12. Movement and Consolidation of VACO's Data Center 

While the majority of VA's servers and other hardware have been moved to various 
locations in Washington, DC and Maryland, there is still network hardware located 
in the basement of VACO that supports VACO telecommunications. Steps have 
been taken to place the VACO data center in a more protected area and further 
action is underway to move this critical infrastructure. A site in West Virginia is 
under construction that will house the Metropolitan Area Network for VACO. 
Completion of this project is expected by December 31, 2006. 

Consolidation of other data centers continues. An example of this consolidation is 
the migration of the White River Junction VA Medical and Regional Office Center 
VistA to the Regional Data Processing Center (RDPC) in Brooklyn, New York. This 
type of consolidation to RDPCs will significantly enhance the IT centralization 
efforts. 
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13. Application Program/Operating System Change Controls 

As a result of the IT Reorganization currently under way, the CIO will mandate 
procedures regarding applications installed on VA computers and for any device 
connected to the VA Internet. The IT Tracker System will be used to ensure that 
equipment to be procured will be properly configured to remedy this condition. 
The reorganization will allow tighter controls over what gets connected to the VA 
backbone. In addition, an Enterprise Change Control Board will be established by 
the end of this calendar year to assist with enforcing standards. 

14. Physical Access Controls 

Better control over physical access through intrusion detection systems has already 
been achieved in most locations throughout VA. However, an additional 
assessment is needed to be sure all sites are in compliance - to include other aspects 
of physical security such as the conditions regarding proper escorting into secure 
areas. Information Security Officers who are now under the control of the CIO will 
have an improved capability to correct these deficiencies. The June 28, 2006, 
Delegation of Authority memorandum will also significantly enhance the ability of 
the CIO to ensure that corrective action is taken where proper access controls are not 
in place. 

15. Wireless Security 

VA had procured a product to mitigate wireless security weaknesses, but it was not 
kept current VA-wide. The Office of Cyber and Information Security's Security 
Operations Center (SOC) is establishing a wireless penetration and assessment 
program that will identify and assist the field with remediation of wireless security 
vulnerabilities. With the new IT realignment, the CIO will direct remediation of 
identified deficiencies in the wireless area, as appropriate. 

I agree that a more extensive review of the wireless security environment needs to 
occur and will be one of the high priority actions for the remainder of FY 06 and 
expect corrective action is this regard is anticipated to be achieved by the end of 
FY 07. 

16. Encrypting Sensitive Information on VA Networks 

Encryption standards have been developed for VA-controlled laptops as directed by 
OMB. I directed that all VA-controlled laptops be inspected and encrypted during 
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VA's Security Awareness Week (June 26-30, 2006). However based upon the advice 
of the Department of Justice attorneys representing VA in the three class action 
lawsuits filed regarding the data loss, I have delayed the review of the laptops. I 
have been advised that plaintiffs' counsel has objected to any alteration of existing 
data on VA-controUed laptops. They allege that any deletion or alteration of the 
existing data might cause destruction of potential evidence in the lawsuits. We 
intend to seek review of this issue by the Courts at the earliest opportunity. Other 
encryption guidance will be established and disseminated by the end of 
August 2006. 

17. FISMA Reporting Database 

As indicated in the IG findings, corrective action is already under way in this area 
and is being further elaborated in response to the most recent FISMA Report. 

This database will be updated and made more accurate. This action will be 
completed by the end of fiscal year 2006. 

Combined Assessment Program (CAP) Reviews Show Information System Security 
Vulnerabilities Continue to Exist 

I agree. It is absolutely critical that these security vulnerabilities be addressed. The 
recently published Directive 6504 described the procedures that must be followed for 
remote network access and the protection of information while at rest and in transit. 
The actions required to improve conditions relative to background checks were 
described in the response to Issue 5. The recently approved Delegation of Authority 
Memorandum together with the on-going IT realignment will provide a significant 
improvement for the overall environment within VA regarding information security. 
We will realize dramatic improvements in all of the areas cited above through the 
support of an enhanced VA Audit and Inspection capability. 

Finding: Policy Changes Implemented by VA Since the Incident Are a Positive Step, 
but More Needs to be Done to Prevent Similar Incidents 

Additional action is required and currently underway. As noted by the Inspector 
General, a number of actions have already been accomplished such as: 

• May 22, 2006 - Secretary's Memorandum to VA employees required all 
employees to complete Cyber Security and Privacy Awareness training by 
June 30, 2006 (TAB 8). 
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May 24, 2006 - Deputy Secretary Memorandum issuing VA IT Directive 06-1, 
establishing the Data Security - Assessment and Strengthening of Controls 
Program (TAB 2). 

May 26, 20006 - Secretary's Directive Memorandum to all VA managers, 
supervisors and team leaders to reiterate their responsibility in ensuring 
information security in their organizations (TAB 9). 

June 7, 2006 Deputy Under Secretary for Health for Operations and Management 
and Deputy Assistant Secretary for Security and Law Enforcement 
Memorandum outlining security practices required for electronic fingerprint 
systems (TAB 10). 

June 5, 2006 - Human Resources and Administration Memorandum required all 
organizations to identify teleworkers by June 6, 2006 (TAB 11). 

June 6, 2006 - Secretary Memorandum suspended the practice permitting VBA 
employees to remove claims files from the regular workstations in order to 
adjudicate claims from an alternative worksite (TAB 12). 

June 6, 2006 - Secretary Memorandum issued VA IT Directive 06-2, which 
requires supervisory approval before removing confidential and Privacy Act 
protected information from the worksite in any data format (TAB 13). 

June 7, 2006 - OIT Memorandum directing VA to complete a data access 
inventory for each employee by June 21, 2006. This inventory has been 
completed. A special Web page on VA's Intranet was used to guide the collect 
this information at: http://vaww.survev.va.gov/surveys/AB9SEA (TAB 14) 

June 7, 2006 - Deputy Secretary issued VA Directive 6504, Restrictions on 
Transmission, Transportation of Use of, and Access to, VA Data Outside VA 
Facilities (TAB 4). 

June 13, 2006 - VHA Deputy Under Secretary for Health for Operations and 
Management disseminated checklist requiring VHA senior leadership 
certification of privacy and security measures (TAB 15). 
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June 19, 2006 - Memorandum from Under Secretary for Health to Assistant 
Secretary for Information and Technology regarding OIG FY 2005 Audit of 
Information Security Program (TAB 16). 

June 20, 2006 - Memorandum from Deputy Under Secretary for Health for 
Operations and Management guidance related to medical transcription (TAB 17). 



• 



June 28, 2006 - Secretary Memorandum - Delegation of Authority for 
Responsibility for Departmental Information Security. This document delegates 
to the Assistant Secretary for Information Technology complete responsibility 
and authority for enforcement of information policies, procedures and practices. 
The Assistant Secretary for Information Technology is also responsible for all 
facets of the VA's information security, including budgeting, training, 
certification and accreditation, incident response and security systems 
engineering (TAB 7). 
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GLOSSARY OF TERMS 


C&A's 


Certification and Accreditation 


CAP 


Combined Assessment Program 


CIO 


Chief Information Officer 


CFS 


Consolidated Financial Statements 


COOP 


Continuity of Operations Plan 


e-QIP 


Electronics Questionnaires for Investigations Processing 


FISMA 


Federal Information Security Management Act 


HIDS 


Host Intrusion Detection System 


IT 


Information Technology 


NCA 


National Cemetery Administration 


NIST 


National Institute of Standards and Technology 


OCIS 


Office of Cyber and Information Security 


OCIST 


Office of Cyber and Information Security Training 


OIG 


Office of Inspector General 


OPF 


Official Personnel Folder 


OPM 


Office of Personnel and Management 


PAID 


Personnel and Accounting Integrated Data 


PC 


Personal Computer 


PKI 


Public Key Infrastructure 


SIC 


Security Investigations Center 


SOC 


Security Operations Center 


TIMS 


The Imaging Management System 


TOPIC 


Transmission of Privacy Information in Clear Text 


VA 


Department of Veterans Affairs 


VA-CIRC 


VA Central Incident Response Capability 


VACO 


Veterans Affairs Central Office 


VBA 


Veterans Benefits Administration 


VHA 


Veterans Health Administration 


VPN 


Virtual Private Network 
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ATTACHMENT INDEX 


TABl 


Administrative Investigation Charge Memoranda 


TAB 2 


May 24, 2006 - Memorandum issued VA IT Directive 06-1, establishing 




the Data Security— Assessment and Strengthening of Controls Program. 


TABS 


Timeline 


TAB 4 


June 7, 2006 - VA Directive 6504, Restrictions on Transmission, 




Transportation of Use of, and Access to, VA Data Outside VA Facilities 


TABS 


Statement of Commitment to be signed by VA employees by July 21, 2006 


TAB 6 


June 28, 2006 - Delegation of Authority for Responsibility for 




Departmental Information Security which provides the CIO the 




enforcement authority previously cited as lacking by the IG. 


TAB 7 


Organizational Chart 


TABS 


May 22, 2006 - Memorandum to all VA employees required all employees 




To complete Cyber Security and Privacy Awareness training by June 30, 




2006. 


TAB 9 


May 26, 2006 - Directive Memorandum to all VA managers, supervisors 




and team leaders to reiterate their responsibility in ensuring information 




security in their organizations. 


TABIC 


June 7, 2006 - Deputy Under Secretary for Health for Operations and 




Management and Deputy Assistant Secretary for Security and Law 




Enforcement Memorandum outlining security practices required for 




electronic fingerprint systems 


TABU 


Jiine 5, 2006 - Memorandum required all organizations to identify 




tele workers by June 6, 2006. 



VA Office of Inspector General 



66 



%^ 



Case 1:06-cv-01038-JR Document18-5 Filed 01/09/2007 Page15of16 
Review of Issues Related to the Loss of VA Information Involving the Identity of Millions of Veterans 



TAB 12 June 6, 2006 - Memorandum suspended the practice permitting VBA 

employees to remove claims files from the regular workstations in order 
to adjudicate claims from an alternative worksite. 

TAB 13 June 6, 2006 - Memorandum issued VA IT Directive 06-2, which requires 

supervisory approval before removing confidential and Privacy Act 
protected information from the worksite in any data format. 

TAB 14 June 7, 2006 - OIT Memorandum directing to complete a data access 

inventory for each employee by June 21, 2006. This inventory has been 
completed. A special web page on VA's Intranet was used to guide the 
collect this information at: http://vaww.survev.va.gov/surveys/AB9SEA 
(TAB 16) 

TAB 15 June 13, 2006 - VHA Deputy Under Secretary for Health for Operations 

and Management disseminated checklist requiring VHA senior leadership 
certification of privacy and security measures. 

TAB 16 June 19, 2006 - Memorandum from Under Secretary for Health to 

Assistant Secretary for Information and Technology regarding OIG FY 
2005 Audit of Information Security Program 

TAB 17 June 20, 2006 - Memorandum from Deputy Under Secretary for Health for 

Operations and Management guidance related to medical transcription. 
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Appendix B 

Report Distribution 

VA Distribution 

Office of the Secretary 
Veterans Health Administration 
Veterans Benefits Adnninistratlon 
National Cemetery Administration 
Assistant Secretaries 
Office of General Counsel 

Non-VA Distribution 

House Committee on Veterans' Affairs 

House Appropriations Subcommittee on Military Quality of Life and Veterans Affairs, 

and Related Agencies 
House Committee on Government Reform 
Senate Committee on Veterans' Affairs 
Senate Appropriations Subcommittee on Military Construction and Veterans' Affairs, 

and Related Agencies 
Senate Committee on Homeland Security and Governmental Affairs 
National Veterans Service Organizations 
Government Accountability Office 
Office of Management and Budget 



This report will be available In the near future on the OIG's Web site at 
http://www.va.gov/oig/52/reports/mainlist.htm . This report will remain on the OIG Web 
site for at least 2 fiscal years after It is issued. 



Additional supporting material provided by the Department of Veterans Affairs may be 

requested by writing to: 

Department of Veterans Affairs 

Office of Inspector General 

FOIA/Privacy Act Section (53B) 

810 Vermont Avenue, NW 

Washington, DC 20420 
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